Audit and Accountability (AU)¶
This page contains all 56 controls and control enhancements in the Audit and Accountability (AU) family from the vendored NIST SP 800-53 Revision 5 OSCAL catalog.
Official NIST OSCAL source
- Catalog version: 5.2.0
- OSCAL version: 1.2.2
- Catalog last modified: May 11, 2026
AU-01 (Policy and Procedures)¶
- a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
- 1. [Selection: one or more of: organization-level; mission/business process-level; system-level] audit and accountability policy that:
- (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
- (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2. Procedures to facilitate the implementation of the audit and accountability policy and the associated audit and accountability controls;
- 1. [Selection: one or more of: organization-level; mission/business process-level; system-level] audit and accountability policy that:
- b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the audit and accountability policy and procedures; and
- c. Review and update the current audit and accountability:
- 1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and
- 2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-02 (Event Logging)¶
- a. Identify the types of events that the system is capable of logging in support of the audit function: [Assignment: organization-defined event types];
- b. Coordinate the event logging function with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
- c. Specify the following event types for logging within the system: [Assignment: organization-defined event types (subset of the event types defined in AU-2a.) along with the frequency of (or situation requiring) logging for each identified event type];
- d. Provide a rationale for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents; and
- e. Review and update the event types selected for logging [Assignment: organization-defined frequency].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-03 (Content of Audit Records)¶
Ensure that audit records contain information that establishes the following:
- a. What type of event occurred;
- b. When the event occurred;
- c. Where the event occurred;
- d. Source of the event;
- e. Outcome of the event; and
- f. Identity of any individuals, subjects, or objects/entities associated with the event.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-03 (01) (Additional Audit Information)¶
Generate audit records containing the following additional information: [Assignment: organization-defined additional information].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-03 (03) (Limit Personally Identifiable Information Elements)¶
Limit personally identifiable information contained in audit records to the following elements identified in the privacy risk assessment: [Assignment: organization-defined elements].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-04 (Audit Log Storage Capacity)¶
Allocate audit log storage capacity to accommodate [Assignment: organization-defined audit log retention requirements].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-04 (01) (Transfer to Alternate Storage)¶
Transfer audit logs [Assignment: organization-defined frequency] to a different system, system component, or media other than the system or system component conducting the logging.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-05 (Response to Audit Logging Process Failures)¶
- a. Alert [Assignment: organization-defined personnel or roles] within [Assignment: organization-defined time period] in the event of an audit logging process failure; and
- b. Take the following additional actions: [Assignment: organization-defined additional actions].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-05 (01) (Storage Capacity Warning)¶
Provide a warning to [Assignment: organization-defined personnel, roles, and/or locations] within [Assignment: organization-defined time period] when allocated audit log storage volume reaches [Assignment: organization-defined percentage] of repository maximum audit log storage capacity.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-05 (02) (Real-time Alerts)¶
Provide an alert within [Assignment: organization-defined real-time period] to [Assignment: organization-defined personnel, roles, and/or locations] when the following audit failure events occur: [Assignment: organization-defined audit logging failure events requiring real-time alerts].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-05 (03) (Configurable Traffic Volume Thresholds)¶
Enforce configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity and [Selection: one or more of: reject; delay] network traffic above those thresholds.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-05 (04) (Shutdown on Failure)¶
Invoke a [Selection: one or more of: full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] in the event of [Assignment: organization-defined audit logging failures], unless an alternate audit logging capability exists.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-05 (05) (Alternate Audit Logging Capability)¶
Provide an alternate audit logging capability in the event of a failure in primary audit logging capability that implements [Assignment: organization-defined alternate audit logging functionality].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-06 (Audit Record Review, Analysis, and Reporting)¶
- a. Review and analyze system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
- b. Report findings to [Assignment: organization-defined personnel or roles]; and
- c. Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
FedRAMP Guidance
This activity is considered vulnerability detection and is subject to the Vulnerability Detection and Response rules.
External Link for Additional Information: myctrl.tools
AU-06 (01) (Automated Process Integration)¶
Integrate audit record review, analysis, and reporting processes using [Assignment: organization-defined automated mechanisms].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-06 (03) (Correlate Audit Record Repositories)¶
Analyze and correlate audit records across different repositories to gain organization-wide situational awareness.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-06 (04) (Central Review and Analysis)¶
Provide and implement the capability to centrally review and analyze audit records from multiple components within the system.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-06 (05) (Integrated Analysis of Audit Records)¶
Integrate analysis of audit records with analysis of [Selection: one or more of: vulnerability scanning information; performance data; system monitoring information] to further enhance the ability to identify inappropriate or unusual activity.
FedRAMP Guidance
This activity is considered vulnerability detection and is subject to the Vulnerability Detection and Response rules.
External Link for Additional Information: myctrl.tools
AU-06 (06) (Correlation with Physical Monitoring)¶
Correlate information from audit records with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-06 (07) (Permitted Actions)¶
Specify the permitted actions for each [Selection: one or more of: system process; role; user] associated with the review, analysis, and reporting of audit record information.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-06 (08) (Full Text Analysis of Privileged Commands)¶
Perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-06 (09) (Correlation with Information from Nontechnical Sources)¶
Correlate information from nontechnical sources with audit record information to enhance organization-wide situational awareness.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-07 (Audit Record Reduction and Report Generation)¶
Provide and implement an audit record reduction and report generation capability that:
- a. Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and
- b. Does not alter the original content or time ordering of audit records.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-07 (01) (Automatic Processing)¶
Provide and implement the capability to process, sort, and search audit records for events of interest based on the following content: [Assignment: organization-defined fields within audit records].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-08 (Time Stamps)¶
- a. Use internal system clocks to generate time stamps for audit records; and
- b. Record time stamps for audit records that meet [Assignment: organization-defined granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or that include the local time offset as part of the time stamp.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-09 (Protection of Audit Information)¶
- a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion; and
- b. Alert [Assignment: organization-defined personnel or roles] upon detection of unauthorized access, modification, or deletion of audit information.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-09 (01) (Hardware Write-once Media)¶
Write audit trails to hardware-enforced, write-once media.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-09 (02) (Store on Separate Physical Systems or Components)¶
Store audit records [Assignment: organization-defined frequency] in a repository that is part of a physically different system or system component than the system or component being audited.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-09 (03) (Cryptographic Protection)¶
Implement cryptographic mechanisms to protect the integrity of audit information and audit tools.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-09 (04) (Access by Subset of Privileged Users)¶
Authorize access to management of audit logging functionality to only [Assignment: organization-defined subset of privileged users or roles].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-09 (05) (Dual Authorization)¶
Enforce dual authorization for [Selection: one or more of: movement; deletion] of [Assignment: organization-defined audit information].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-09 (06) (Read-only Access)¶
Authorize read-only access to audit information to [Assignment: organization-defined subset of privileged users or roles].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-09 (07) (Store on Component with Different Operating System)¶
Store audit information on a component running a different operating system than the system or component being audited.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-10 (Non-repudiation)¶
Provide irrefutable evidence that an individual (or process acting on behalf of an individual) has performed [Assignment: organization-defined actions].
FedRAMP Parameters
| Parameter ID | NIST assignment | FedRAMP value |
|---|---|---|
au-10_odp |
actions | at least actions including the addition, modification, deletion, approval, sending, or receiving of data |
External Link for Additional Information: myctrl.tools
AU-10 (01) (Association of Identities)¶
- (a) Bind the identity of the information producer with the information to [Assignment: organization-defined strength of binding]; and
- (b) Provide the means for authorized individuals to determine the identity of the producer of the information.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-10 (02) (Validate Binding of Information Producer Identity)¶
- (a) Validate the binding of the information producer identity to the information at [Assignment: organization-defined frequency]; and
- (b) Perform [Assignment: organization-defined actions] in the event of a validation error.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-10 (03) (Chain of Custody)¶
Maintain reviewer or releaser credentials within the established chain of custody for information reviewed or released.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-10 (04) (Validate Binding of Information Reviewer Identity)¶
- (a) Validate the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: organization-defined security domains]; and
- (b) Perform [Assignment: organization-defined actions] in the event of a validation error.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-11 (Audit Record Retention)¶
Retain audit records for [Assignment: organization-defined time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-11 (01) (Long-term Retrieval Capability)¶
Employ [Assignment: organization-defined measures] to ensure that long-term audit records generated by the system can be retrieved.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-12 (Audit Record Generation)¶
- a. Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2a on [Assignment: organization-defined system components];
- b. Allow [Assignment: organization-defined personnel or roles] to select the event types that are to be logged by specific components of the system; and
- c. Generate audit records for the event types defined in AU-2c that include the audit record content defined in AU-3.
FedRAMP Parameters
| Parameter ID | NIST assignment | FedRAMP value |
|---|---|---|
au-12_odp.01 |
system components | at least all information system and network components where audit capability is deployed/available |
External Link for Additional Information: myctrl.tools
AU-12 (01) (System-wide and Time-correlated Audit Trail)¶
Compile audit records from [Assignment: organization-defined system components] into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: organization-defined level of tolerance].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-12 (02) (Standardized Formats)¶
Produce a system-wide (logical or physical) audit trail composed of audit records in a standardized format.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-12 (03) (Changes by Authorized Individuals)¶
Provide and implement the capability for [Assignment: organization-defined individuals or roles] to change the logging to be performed on [Assignment: organization-defined system components] based on [Assignment: organization-defined selectable event criteria] within [Assignment: organization-defined time thresholds].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-12 (04) (Query Parameter Audits of Personally Identifiable Information)¶
Provide and implement the capability for auditing the parameters of user query events for data sets containing personally identifiable information.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-13 (Monitoring for Information Disclosure)¶
- a. Monitor [Assignment: organization-defined open-source information and/or information sites] [Assignment: organization-defined frequency] for evidence of unauthorized disclosure of organizational information; and
- b. If an information disclosure is discovered:
- 1. Notify [Assignment: organization-defined personnel or roles]; and
- 2. Take the following additional actions: [Assignment: organization-defined additional actions].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-13 (01) (Use of Automated Tools)¶
Monitor open-source information and information sites using [Assignment: organization-defined automated mechanisms].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-13 (02) (Review of Monitored Sites)¶
Review the list of open-source information sites being monitored [Assignment: organization-defined frequency].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-13 (03) (Unauthorized Replication of Information)¶
Employ discovery techniques, processes, and tools to determine if external entities are replicating organizational information in an unauthorized manner.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-14 (Session Audit)¶
- a. Provide and implement the capability for [Assignment: organization-defined users or roles] to [Selection: one or more of: record; view; hear; log] the content of a user session under [Assignment: organization-defined circumstances]; and
- b. Develop, integrate, and use session auditing activities in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-14 (01) (System Start-up)¶
Initiate session audits automatically at system start-up.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-14 (03) (Remote Viewing and Listening)¶
Provide and implement the capability for authorized users to remotely view and hear content related to an established user session in real time.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-16 (Cross-organizational Audit Logging)¶
Employ [Assignment: organization-defined methods] for coordinating [Assignment: organization-defined audit information] among external organizations when audit information is transmitted across organizational boundaries.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-16 (01) (Identity Preservation)¶
Preserve the identity of individuals in cross-organizational audit trails.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-16 (02) (Sharing of Audit Information)¶
Provide cross-organizational audit information to [Assignment: organization-defined organizations] based on [Assignment: organization-defined cross-organizational sharing agreements].
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools
AU-16 (03) (Disassociability)¶
Implement [Assignment: organization-defined measures] to disassociate individuals from audit information transmitted across organizational boundaries.
This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values.
External Link for Additional Information: myctrl.tools